Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linus Torvalds: “Somebody is pushing complete garbage for unclear reasons.”

lkml.iu.edu

Post reply on HN
Print view View original

501–510 of 702 posts

Re: Linus Torvalds: “Somebody is pushing complete garbage for unclear reasons.”

#501

Post by mrmondo »

smcleod wrote: post #19

In case it’s unclear to anyone, David Woodhouse (the person Linus is replying to / previous poster) works for Amazon and previously Intel[1] aka @dwmw2 on Twitter, ironically his twitter profile is: “Kernel hacker. Known to occasionally promote an attitude of violence towards complete morons.” *[1] Correction, I thought (as does Google) that he still worked at Intel, but it was pointed out that he now works at Amazon…

* Principal Engineer - Amazon Web Services - Employed Oct 2016 – Present - Employment Duration 1 yr 4 mo

* Intel Corporation - Linux Kernel Engineer - Employed Jun 2008 – Oct 2016 - Employment Duration 8 yrs 5 mos

Source: LinkedIn - https://www.linkedin.com/in/dwmw2/

Note: Also, this is not and please do not turn this into a personal witch-hunt or anything like that, I am just adding context / clarification as to the mailing list thread.

Re: Linus Torvalds: “Somebody is pushing complete garbage for unclear reasons.”

#502

Post by snambi »

Cthulhu_ wrote: post #126
joelthelion wrote: post #85

Earlier quoted context omitted.

> FOSS is so important FOSS is nice, but it's not a silver bullet. In this case I think Linus is largely to thank. Things will be a lot harder if he decides to retire.

A silver bullet is having one smart guy at the top who doesn't care how much pressure you exert on getting something into the codebase, or how much man-hours were spent (sunk cost fallacy). I think in a lot of "corporate" projects (not-open source) there's much less of that and the software is designed by commission, with the lead developer(s) quickly no longer having much of an influence on the code itself, being dr…

We may be we can train an MBA to do Linus's job? ;)

Re: Linus Torvalds: “Somebody is pushing complete garbage for unclear reasons.”

#503

Post by shakna »

jnordwick wrote: post #336
shakna wrote: post #216

Earlier quoted context omitted.

I'm afraid that jnordwick doesn't consider PoCs to be "real" enough for some reason. [0] I think he's waiting for a piece of malware to be found in the wild before he'll consider it a problem.

Just something that would work in the wild. There are a number of things that might theoretically be possible if the machine of complicit with you but aren't actually exploitable. Like i said: - JavaScript appears to not be a possible attack vector. So now we're just worried about already had access to run a native binary. - so a native program that sat snooping sudo passwords would be a good demo, but obviously if a…

I'm afraid I still don't understand you.

> JavaScript appears to not be a possible attack vector. So now we're just worried about already had access to run a native binary.

All the major browsers have pushed patches, to close this, because it was a gaping hole. You're only not worried, because they've already fixed it. (Well, when I say major browsers, I haven't seen or heard anything from Microsoft's Chakra engine.)

Take note that it involved killing off SharedArrayBuffer in JS, at least for now.

> but obviously if a rogue binary had to sit running for days with only a part success rate

That's misreading the situation.

A tight loop is required, yes, with partial failure, but it is not so low as taking days. The original implementation [0], read at around 10KB/s. Whilst that isn't fast if you're somehow trying to read gigabytes of data into cache, and then attack it, it's more than enough to read passwords out of data.

> So now we're just worried about already had access to run a native binary.

Now we're worried about any unpatched JavaScript engine, like perhaps Chakra, which would make all Edge users vulnerable.

You also don't need access to an executable binary. You could also target any DLL that gets dynamically linked on Windows. In fact, the example Windows implementation hooks into ntdll.dll, which has a known location on all versions of Windows, which allows it to bypass ASLR.

[0] https://spectreattack.com/spectre.pdf

Re: Linus Torvalds: “Somebody is pushing complete garbage for unclear reasons.”

#504

Post by Jach »

shakna wrote: post #503
jnordwick wrote: post #336

Earlier quoted context omitted.

Just something that would work in the wild. There are a number of things that might theoretically be possible if the machine of complicit with you but aren't actually exploitable. Like i said: - JavaScript appears to not be a possible attack vector. So now we're just worried about already had access to run a native binary. - so a native program that sat snooping sudo passwords would be a good demo, but obviously if a…

I'm afraid I still don't understand you. > JavaScript appears to not be a possible attack vector. So now we're just worried about already had access to run a native binary. All the major browsers have pushed patches, to close this, because it was a gaping hole. You're only not worried, because they've already fixed it. (Well, when I say major browsers, I haven't seen or heard anything from Microsoft's Chakra engine.)…

I'm not sure I understand his position on Spectre, but he's been pretty clear that for the most part he's been talking about Meltdown. Honestly I'm not familiar with how much of a perf hit the Meltdown patch alone causes, because I always see the bad perf numbers with their combination, but I suspect it's bad. Since Meltdown has no JS exploit, there's no reason to worry about JS. Given that browser exploits are out of the question, the threat reduces to the normal threat of running untrusted code. I see no reason to worry more about Meltdown specifically than I have to worry about any application I run sneakily running `xinput test-xi2 --root`, so given the choice, I'm not going to apply the Meltdown patches on my desktop machine and suffer a perf hit for no good reason. Spectre patches, maybe, but I might not if the browser situation is confidently dealt with.

Re: Linus Torvalds: “Somebody is pushing complete garbage for unclear reasons.”

#505

Post by jacquesm »

mcv wrote: post #349
rebuilder wrote: post #289

Earlier quoted context omitted.

Would this be bad faith? Assume no fix is available, at least for existing processors, that doesn't result in reduced performance. What should Intel do? - Force users to take the performance hit? - Let users decide whether to take the performance hit in exchange for security?

Users can already choose. They can buy old processors without the fix. I really don't see what case anyone could have against Intel if they just fixed this. Having a fix but turning it off by default seems far more dangerous from a legal perspective. Or having the processor perform far worse in reality than advertised.

> They can buy old processors without the fix.

Tell me where you could buy old processors in sufficient quantity today and please explain how a modern motherboard with sufficient RAM would hold such an old processor?

Re: Linus Torvalds: “Somebody is pushing complete garbage for unclear reasons.”

#507

Post by trentnelson »

azinman2 wrote: post #361
EamonnMR wrote: post #302

Earlier quoted context omitted.

If you're a Cutler fan you may enjoy Showstopper[1], an account of the creation of NT. 1: https://www.amazon.com/Show-Stopper-Breakneck-Generation-Mic...

Thanks for the rec, looks interesting.

It's a great book. Motivated me to switch industries and relocate to Seattle as an NT kernel programmer.

Re: Linus Torvalds: “Somebody is pushing complete garbage for unclear reasons.”

#508

Post by musage »

nippples wrote: post #145
watwut wrote: post #42

Earlier quoted context omitted.

Why should they ask politely? It is not like the Linux mailing list would be polite environment. Nothing against impolite environment, people make case for it daily here and I don't care. But it combined with the standard expectation that when someone else talks to them he should be always polite is getting funny in that context.

There's more ways to be impolite than saying nasty words. Linus had been treating all this situation very fairly so far, but I guess Intel just had to repeatedly try pushing very bad fixes to a problem they created themselves. Imagine you go to a restaurant, and the waiter just repeatedly brings you the wrong order, repeatedly.

> Imagine you go to a restaurant, and the waiter just repeatedly brings you the wrong order, repeatedly.

I agree with you in general, but that's a bad example IMO. If they are stressed out and make honest mistakes, even if they're totally incompetent and stupid, I would probably laugh harder each subsequent time and assure them it's no big deal, and it would be true. With anyone, but doubly so with anyone who handles my food.

If on the other hand they just didn't care etc., I'd leave at some point and never return. The point at which there would be something to get nasty about is also past the point where it would still make sense to be nasty about it, if you know what I mean.

Not that I think Linus is being particularly nasty, and as I said, I generally agree. But that example rubbed me the wrong way, I just had to speak up, sorry ^^

Re: Linus Torvalds: “Somebody is pushing complete garbage for unclear reasons.”

#510

Post by FuckOffNeemo »

syshum wrote: post #329
piyush_soni wrote: post #257

Earlier quoted context omitted.

Again, your understanding is that intelligent people have the right to abuse. That's just akin to supporting oppression of weaker by stronger. That might be how things are for a lot of people, but not how they should be. Also, mad internet people have historically changed a lot of things, so I'm justified in showing my disapproval even if it won't change Linus. Changing at least one upcoming Linus in life would be a…

>> right to abuse. Equating harsh even personally offensive language to "abuse" is the biggest disagreement here. Many people, myself included, prescribe to axiom of "sticks and stones will break my bones but words can never hurt me" I understand that the current generation believes that feels are the most important thing ever... I reject the idea that a person has the right not be offended, and I reject the idea tha…

Started writing a response before reading your own, I think you've nailed my perspective on the matter.

Abuse is not offense, offense is not abuse.

Post reply on HN